RISK AND CONTROL SELF ASSESSMENT AND KEY RISK INDICATOR

RCSA is a structured process by which business units identify, assess, and evaluate operational risks and the effectiveness of existing controls in their activities. It enables proactive risk management by involving frontline staff in recognizing potential risk exposures.

Business units assess their own risks and controls independently.

The primary objective of RCSA is to identify inherent operational risks and assess the adequacy of controls, helping management understand the residual risk remaining after controls are applied. It promotes a risk-aware culture across the organization.

Breach signals risk level exceeding tolerance, triggering escalation to management.

Inherent risk is the level of risk existing before any controls are applied, while residual risk is the risk remaining after factoring in the effectiveness of implemented controls. RCSA aims to reduce residual risk to an acceptable level within the bank's risk appetite.

Quantitative KRIs are numerical; qualitative KRIs are descriptive or subjective assessments.

RCSA workshops are typically conducted using facilitated group discussions, structured interviews, surveys/questionnaires, and self-assessment forms completed by business unit staff. Facilitators from the risk management function guide participants through identification and rating of risks.

A documented inventory of identified risks, controls, and their ratings.